CVE-2026-60004 Exploited in the wild
Gitea Code Injection Vulnerability
- Risk score
- 73/100
- CVSS
- Not Scored
- Added to CISA's exploited list
- 25 Aug 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
- Affected
- Gitea
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Exploited in the wild
Story map
At a glance
Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…
The flaws
- CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
- CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
- CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)
- CVE-2026-96404: Authentication bypass (CVSS 8.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Gitea
Where it stands
- Exploited in the wild
- On CISA's exploited list since 25 Aug
- US federal deadline 28 Aug
How it unfolded
- 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
- 28 Aug, Deadline (official): US federal agencies must have patched
Connects to
- Same weakness: Code injection (CWE-94). 239 other warnings in 30 days
- Same product: Earlier Gitea warnings. 25 in the last 90 days
Why it is Amber
- Not yet scored by NVD
- Exploited in the wild (CISA KEV)
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Original description
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Last activity 25 Aug 2026. Patch Forecast updates every hour.